Method and device for monitoring the state of a facility

ABSTRACT

This invention provides method for detecting advance signs of anomalies, event signals outputted from the facility are used to create a separate mode for each operating state, a normal model is created for each mode, the sufficiency of learning data for each mode is checked, a threshold is set according to the results of said check, and anomaly identification is performed using said threshold. Also, for diagnosis, a frequency matrix is created in advance, with result events on the horizontal axis and cause events on the vertical axis, and the frequency matrix is used to predict malfunctions. Malfunction events are inputted as result events, and quantized sensor signals having anomaly measures over the threshold are inputted as cause events.

TECHNICAL FIELD

The present invention relates to a method and a device for monitoringthe state that detects an anomaly based on multi-dimensional time-seriesdata output from a plant or facility early and diagnose a phenomenon.

BACKGROUND ART

Electric power companies supply hot water for district heating by usingwaste heat of a gas turbine or supply high-pressure steam orlow-pressure stream for a factory. Petrochemical companies are operatingthe gas turbine, and the like as power facilities. In various plants orfacilities using the gas turbine, and the like, preventive maintenancethat detects malfunctions in the facilities or indications thereof isvery important to even minimally suppress damages to a society. Further,an anomaly diagnosis that describes an anomaly phenomenon as well as thedetection is also important to take appropriate actions.

In addition to the gas turbine or a stream turbine, even in a turbine ina hydroelectric plant, a nuclear reactor in a nuclear power plant, awindmill of a wind power plant, an engine of an aircraft or a heavymachine, a railroad vehicle or a track, an escalator, an elevator, andan apparatus/component level, facilities requiring the preventivemaintenance such as the deterioration/lifespan of mounted batteries arenumerous. In recent years, detecting anomalies (various symptoms) for ahuman body becomes also important for health management as shown in anelectroencephalogram measurement/diagnosis.

As a result, U.S. Pat. No. 6,952,662 (Patent Literature 1) or U.S. Pat.No. 6,975,962 (Patent Literature 2) discloses an anomaly detectingmethod primarily targeting an engine.

In the anomaly detecting method, with past data, i.e., a time-seriessensor signal as a database, the similarity between observational dataand past learning data is calculated in an independent method and anestimate value is computed by linear coupling of data having highsimilarity to output a displacement degree between the estimate valueand the observational data.

Further, Japanese Patent No. 3,631,118 discloses an anomaly diagnosingmethod of evaluating the similarity between input data and case datawith the case data registered as the database and outputting apredetermined event name corresponding to a case having the highestsimilarity in advance.

CITATION LIST Patent Literature

-   Patent Literature 1: U.S. Pat. No. 6,952,662-   Patent Literature 2: U.S. Pat. No. 6,975,962-   Patent Literature 3: Japanese Patent No. 3631118

Non Patent Literature

-   Non Patent Literature 1: Stephan W. Wegerich; Nonparametric modeling    of vibration signal features for equipment health monitoring,    Aerospace Conference, 2003. Proceedings. 2003 IEEE, Volume 7, Issue,    2003 Page(s): 3113-3121

SUMMARY OF INVENTION Technical Problem

In the method disclosed in Patent Literature 1 or Patent Literature 2,if observational data not included in the learning data is observed, allof them are treated as data not included in the learning data to bejudged as a displacement value and judged as an anomaly even in a normalsignal, thereby remarkably deteriorating inspection reliability. As aresult, a user needs to exhaustively store past various-state data inthe database as the learning data.

Meanwhile, when the anomaly is mixed into the learning data, adivergence degree from the observational data showing the anomaly isreduced to be overlooked. As a result, sufficient checks are required toprevent the anomaly from being included in the learning data. However,since methods for exhaustive data collection and exclusion of theanomaly are not disclosed in Patent Literature 1 or Patent Literature 2,the user bears the burden. Since it is necessary to elaborately handle atemporal change or a surrounding environmental variation, or a repairingoperation such as component replacement or not, it is substantiallydifficult and impossible to perform the handling personally in manycases.

In the method disclosed in Patent Literature 3, since the casecorresponding to the event is recorded in the database as it is, theground for the anomaly judgment cannot be explained, and as a result, itis difficult to convince the user. Further, anomaly prior-warning andthe event are not associated with each other.

Accordingly, an object of the present invention is to provide a methodand a system for monitoring the state of facility that solves theproblems and includes an anomaly prior-warning detecting method capableof detecting an anomaly prior-warning with high sensitivity withoutincreasing a user burden even though learning data is insufficient andan anomaly diagnosis method enabling the detection and a description ofthe anomaly and anomaly prior-warning, i.e., describing which state ofthe sensor signal is based on the anomaly judgment.

Further, an object of the present invention is to provide an anomalyprior-warning detection method capable of creating a high-precisionnormal model by using only appropriate learning data without increasingthe user burden even when an anomaly is mixed into the learning data.

In addition, a used sensor item needs to be looked over in order todetect the anomaly prior-warning with high precision, however, aselection method of the sensor item is not described in PatentLiterature 1 or 2, and as a result, a user's efforts are required.

Accordingly, an object of the present invention is to provide an anomalyprior-warning detection method capable of creating the high-precisionnormal model by excluding a sensor item disturbing the sensitivitywithout increasing the user burden.

Solution to Problem

In order to achieve the objects, in the present invention, in monitoringthe state of facility based on a time-series sensor signal and an eventsignal output from the facility or a manufacturing apparatus, or ameasurement apparatus, mode dividing for each operating state isperformed based on the event signal, a normal model is created for eachmode based on the sensor signal, an anomaly measurement is computed bycomparing the normal model and the sensor signal, sufficiency oflearning data used to create the normal model for each mode is checked,and an anomaly is identified based on the anomaly measurement aftersensitivity is set according to the sufficiency of the learning data.

Further, all events or a sensor signal judged as the anomaly isquantized to be set as a cause event, a failure event which occurs fromoccurrence of the cause event to the passage of a predetermined time isset as a result event, a frequency matrix of the cause event and theresult event is created, and a failure which occurs within apredetermined time after a predetermined event occurs is predicted basedon the matrix.

That is, in the present invention, a method for monitoring the state offacility that detects an anomaly based on a time-series sensor signaland an event signal output from the facility or an apparatus includes: alearning process of dividing a mode for each operating state based onthe event signal, extracting a feature vector based on the sensorsignal, creating a normal model for each mode based on the featurevector, checking sufficiency of the learning data used for creating thenormal model for each mode, and setting a threshold in accordance withthe sufficiency of the learning data; and an anomaly detecting processof dividing the mode for each operating state based on the event signal,extracting the feature vector based on the sensor signal, computing ananomaly measurement by comparing the feature vector with the normalmodel, and identifying the anomaly by comparing the threshold with theanomaly measurement.

Further, in the present invention, a method for monitoring the state offacility includes: mode-dividing a time-series event signal output fromthe facility or an apparatus in accordance with an operating state ofthe facility or apparatus; acquiring a feature vector from a time-seriessensor signal output from the facility or apparatus; creating a normalmodel for each divided mode by using the mode dividing information andinformation on the feature vector acquired from the sensor signal;computing an anomaly measurement of the feature vector for each dividedmode by using the created normal model; judging an anomaly by comparingthe computed anomaly measurement with a predetermined threshold; anddiagnosing whether the facility or apparatus is anomalistic by using thejudged anomaly information and the sensor signal.

Further, in the present invention, a device for monitoring the state offacility includes: a mode dividing means inputting a time-series eventsignal output from the facility or an apparatus to mode-divide the eventsignal in accordance with an operating state of the facility orapparatus; a feature-vector computation means inputting the time-seriessensor signal output from the facility or apparatus to acquire a featurevector from the input sensor signal; a normal-model creation meanscreating a normal model for each divided mode by using the mode dividinginformation from the mode dividing means and information on the featurevector of the sensor signal acquired by the feature-vector computationmeans; an anomaly-measurement computation means computing an anomalymeasurement of the feature vector acquired by the feature-vectorcomputation means for each divided mode by using the normal modelcreated by the normal-model creation means; an anomaly judgment meansjudging an anomaly by comparing the anomaly measurement computed by theanomaly-measurement computation means with a predetermined threshold;and an anomaly diagnosis means diagnosing whether the facility orapparatus is anomalistic by using the information on the anomaly judgedby the anomaly judgment means and the time-series sensor signal outputfrom the facility or apparatus.

Further, in the present invention, in monitoring the state of facilitybased on a time-series sensor signal output from the facility or amanufacturing apparatus, or a measurement apparatus, a feature vector isextracted based on the sensor signal, a feature to be used is selectedbased on data check of the feature vector, learning data to be used areselected based on the data check of the feature vector, a normal modelis created based on the feature vector, an anomaly measurement iscomputed by comparing the normal model and the sensor signal with eachother, sufficiency of the learning data used to create the normal modelis checked, and sensitivity is set according to the sufficiency of thelearning data, and then, an anomaly is identified based on the anomalymeasurement.

That is, in the invention, a method for monitoring the state of facilitythat detects an anomaly based on a time-series sensor signal output fromthe facility or an apparatus includes: a learning process of extractinga feature vector based on the sensor signal, selecting a feature to beused based on data check of the feature vector, selecting learning datato be used based on the data check of the feature vector, creating anormal model based on the feature vector, checking sufficiency of thelearning data used for creating the normal model, and setting athreshold in accordance with the sufficiency of the learning data; andan anomaly detecting process of extracting the feature vector based onthe sensor signal, computing an anomaly measurement by comparing thefeature vector with the normal model, and identifying the anomaly bycomparing the threshold with the anomaly measurement.

Advantageous Effects of Invention

According to the present invention, in order to perform mode dividingfor each operating state and create a normal model for each mode, normalmodels corresponding to various states can be created with highprecision. Further, sufficiency of learning data is checked for eachmode and when data is insufficient, identification is performed bydecreasing sensitivity to prevent misjudgment caused by insufficientdata, thereby improving reliability of anomaly detection.

Further, a casual relationship between events can be learned by creatinga frequency matrix of a cause event and a result event and inparticular, the sensor signal is quantized to be set as the cause event,thereby associating the state of the sensor signal with an anomaly. Inaddition, a failure event which occurs from the occurrence time of thecause event to the passage of a predetermined time is set as the resultevent to associate an anomaly prior-warning and the occurrence of thefailure with each other, and as a result, the failure occurrence can bepredicted based on the state of the sensor signal.

As described above, even in a turbine in a hydroelectric plant, anuclear reactor in a nuclear power plant, a windmill of a wind powerplant, an engine of an aircraft or a heavy machine, a railroad vehicleor a track, an escalator, an elevator, and an apparatus/component level,in addition to facility such as a gas turbine or a stream turbine,facilities such as the deterioration/lifespan of mounted batteries, theanomaly and the anomaly prior-warning can be detected and diagnosed withhigh precision.

Further, according to the present invention, since the feature and thelearning data which are used are automatically selected based on datacheck of the feature vector, the user can create a high-precision normalmodel only by inputting the whole sensor signals without looking overthe used feature and learning data, such that high-sensitive anomalydetection can be implemented with a minimum effort.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1A is a block diagram illustrating a schematic configuration of asystem for monitoring the state of facility of the present invention.

FIG. 1B is a flowchart illustrating a flow of processing in learning.

FIG. 1C is a flowchart illustrating a flow of processing when an anomalyis detected.

FIG. 2A is a signal list illustrating an example of an event signal.

FIG. 2B is a flowchart illustrating a flow of processing afterperforming mode dividing by receiving the event signal.

FIG. 2C is a mimetic diagram of the event signal illustrating the statein which an operating state of the facility is divided and classifiedinto any one of four modes.

FIG. 3 is a flowchart describing a flow of processing of a secondembodiment of a mode dividing method based on event information.

FIG. 4 is a signal waveform diagram illustrating an example of a sensorsignal.

FIG. 5 is a flowchart illustrating an example of a normal model creationprocessing sequence.

FIG. 6 is a graph of a 3D coordinate describing a projection distancemethod.

FIG. 7 is a diagram describing a local sub-space classifier.

FIG. 8 is a graph illustrating an example of an anomaly measurementcomputation result.

FIG. 9A is a front view of a screen displaying plural signal waveformsin an example of a display screen in checking learning data.

FIG. 9B is a front view of a screen displaying plural feature vectors inan example of a display screen in checking learning data.

FIG. 9C is a front view of a screen enlarging and displaying pluralsignal waveforms in an example of a display screen in checking learningdata.

FIG. 9D is a front view of a screen displaying an anomaly measurementand an enlarged diagram of the corresponding part in an example of adisplay screen in checking learning data.

FIG. 9E is a front view of a screen displaying an accumulated histogramlist of a mode for each used mode and displaying a threshold parameternext thereto in an example of a display screen in checking learningdata.

FIG. 10A is a flowchart illustrating a sequence of creating a frequencymatrix.

FIG. 10B is a frequency matrix table.

FIG. 100 is a flowchart illustrating a flow of processing in evaluationusing the frequency matrix.

FIG. 11A is a flowchart illustrating a sequence of creating thefrequency matrix by using only an event signal without using a sensorsignal.

FIG. 11B is a frequency matrix table.

FIG. 12A is a block diagram illustrating a schematic configuration of asystem for monitoring the state of facility of the present invention.

FIG. 12B is a flowchart illustrating a flow of processing in learning.

FIG. 12C is a flowchart illustrating a flow of processing when ananomaly is detected.

FIG. 13 is a plot diagram of daily mean and distribution.

FIG. 14 is a diagram illustrating a waveform model of one day.

FIG. 15 is a diagram describing a method of attaching a label to data.

FIG. 16 is a flowchart illustrating a flow of feature selectionprocessing in learning.

FIG. 17 is a plot diagram of daily mean and distribution.

FIG. 18 is a flowchart illustrating a flow of learning data selectionprocessing in learning.

FIG. 19 is a block diagram illustrating a schematic configuration of asystem for monitoring the state of facility in a third embodiment.

DESCRIPTION OF EMBODIMENTS

Hereinafter, the content of the present invention will be described indetail with reference to the drawings.

First Embodiment

FIG. 1A illustrates one configuration example of a system thatimplements a method for monitoring the state of a facility of thepresent invention.

The system is configured to largely include a sensor signal analysisunit 100 and an anomaly diagnosis unit 110.

The sensor signal analysis unit is configured to include a featureamount extraction unit 105 that receives a sensor signal 102 output fromfacility 101 to perform feature selection, feature amount extraction,and feature conversion of the signal and acquire a feature vector, amode dividing unit 104 that divides the time (in the followingdescription, the dividing is referred to as mode dividing and a type ofan operating state is referred to as a mode) according to a change inthe operating state of the facility 101 by receiving an event signal 103output from the facility 101, a normal-model creating unit creating anormal model by receiving outputs of the feature amount extraction unit105 and the mode dividing unit 104, an anomaly-measurement computationunit 107 computing anomaly measurement from the sensor signal extractedby the feature amount extraction unit 105 by using the normal modelcreated by the normal-model creation unit 106, a learning-data checkunit 108 checking the normal model based on the anomaly measurementcomputed by the anomaly-measurement computation unit 107 with respect tothe normal model created by the normal-model creation unit 106, ananomaly identification unit 109 identifying anomaly based on data of thenormal model checked by the learning-data checking unit 108 and theanomaly measurement computed from the sensor signal 102 by using theanomaly-measurement computation unit 107, and an anomaly diagnosis unit110 diagnosing anomaly of the facility 101 from the sensor signal 102and the judgment result of the anomaly identification unit 109.

The operation of the system includes two phases of ‘learning’ thatcreates a model used for anomaly pre-detection or diagnosis in advanceand ‘evaluation’ that actually performs anomaly pre-detection ordiagnosis based on the model and an input signal. Basically, the formeris off-line processing and the latter is on-line processing. In thefollowing description, they are distinguished as in learning and inevaluation.

The facility 101 as a state monitoring target is a facility such as agas turbine or a steam turbine or a plant. The facility 101 outputs thesensor signal 102 and the event signal 103 indicating the state thereof.

A flow of processing in learning will be described by using FIG. 1B. Themode dividing unit 104 inputs the event signal 103 output from thefacility 101 (S101) and mode-divides an operating time of the facility101 according to the change in the operating state (S102). Meanwhile,the feature amount extraction unit 105 inputs the sensor signal 102output from the facility 101 (S103) and performs feature selection,feature amount extraction, and feature conversion, and acquires thefeature vector (S104).

The mode dividing information from the mode dividing unit 104 and thefeature vector information from the feature amount extraction unit 105are input into the normal-model creation unit 106 to select the learningdata from the feature vector (S105), perform learning for each mode byusing the selected learning data, and create the normal model (S106).The created normal model is input into the anomaly-measurementcomputation unit 107 together with the feature vector information fromthe feature amount extraction unit 105 to compute the anomalymeasurement (S107).

Subsequently, the learning-data check unit 108, sufficiency of thelearning data used to create the normal model for each mode is examinedbased on the information on the anomaly measurement computed by theanomaly-measurement computation unit 107 (S108). That is, it is examinedwhether the created normal model can express a normal state in the modenormally. In the learning data judged that the normal state can beexpressed in the corresponding mode by using the learning-data checkunit 108, a threshold used to identify anomaly is set according to thecheck result (S109). That is, when the learning data is insufficient,the threshold is increased in order to prevent misjudgment of judginganomaly in spite of the normal state.

Subsequently, a flow of processing in evaluation will be described byusing FIG. 10. The mode dividing unit 104 inputs the event signal 103output from the facility 101 (S111) and divides the operating time ofthe facility 101 by mode (mode-divide) according to the change in theoperating state (S112). Meanwhile, the feature amount extraction unit105 inputs the sensor signal 102 output from the facility 101 (S113) andperforms feature selection, feature amount extraction, and featureconversion, and acquires the feature vector (S114). The mode dividinginformation from the mode dividing unit 104 and the feature vectorinformation from the feature amount extraction unit 105 are input intothe anomaly-measurement computation unit 107 to classify the featurevector for each mode and are compared with the stored normal modelcreated by the normal-model creation unit 106 in learning to compute theanomaly measurement (S115).

The computed anomaly measurement is input into the anomalyidentification unit 109 and compared with the threshold set in learningto perform anomaly judgment (S116). The result of the anomaly judgmentis sent to the anomaly diagnosis unit 110 to perform diagnosis on thesensor signal 102 at the time when an anomaly is judged in evaluationbased on learned and stored information on the relations between theevent signal 103 in learning and the sensor signal 102 at the time ofanomaly judgment (S117).

Subsequently, operations of individual components shown in FIG. 1A willbe described in detail sequentially.

A first embodiment of a mode dividing method in the mode dividing unit104 will be described using FIGS. 2A to 2C. An example of the eventsignal 103 is shown in FIG. 2A. The event signal 103 is a signalindicating an operation, a failure, or a warning of the facility whichis output irregularly and is constituted by a character stringindicating the time and the operation, the failure, or the warning. Asshown in FIG. 2B, the event signal 103 is input (S201) and extraction ofa start sequence and a stop sequence is performed by retrieving apredetermined character string (S202). Based on the result, the mode isdivided into 4 operating states of a ‘normal OFF’ mode 211 from an endtime of the stop sequence to a start time of the start sequence, a‘start’ mode 212 during the start sequence, a ‘normal ON’ mode 213 froman end time of the start sequence to a start time of the stop sequence,and a ‘stop’ mode 214 during the stop sequence (S203).

An example is shown in FIG. 2C. For sequence extraction, a start eventand an end event of the sequence are designated in advance and thesequence is scanned and extracted from a head and a tail of the eventsignal 103 in the following method.

(1) In case not during the sequence, the start event is retrieved. Whenthe start event is discovered, the sequence is started.

(2) In case during the sequence, the stop event is retrieved. When thestop event is discovered, the sequence is stopped.

Herein, the stop event includes the stop event of the designation, thestart event of the failure, the warning, and the designation. In thecase of the stop other than the stop event of the designation, the stopis recorded as an anomaly stop. Hereinafter, a period during thesequence which is sequentially extracted from the event signal as aboveand a period other than the period during the sequence are called a‘cluster’.

A second embodiment of the mod dividing method will be described byreferring FIG. 3. The first embodiment is an example of the case inwhich the start and the stop of the start sequence and the stop sequencecan be designated and the 4 modes will be shown in sequence. But herein,the second embodiment shows an example of the case in which thedesignation cannot be performed. First, the event signal 103 is input(S301) and the event signal 103 is separated when a time interval isequal to or more than the threshold (S302), and an event array iscreated from the remaining event signal. Subsequently, all unique eventarrays are listed up (S303) and the similarity between the event arraysis examined (S304). For example, when the lengths of the event arraysare set as L1 and L2 and the numbers of deleted and added eventsrequired to change one side to the other side is C, the similarity isrepresented by the following equation.

(L1+L2−C)/(L1+L2)  (Equation 1)

For example, when an event array of one side is aabc and an event arrayof the other side is abb, L1=4, L2=3, and C=3 (the latter is acquired bydeleting a and c from the former and adding b), the similarity is4/7=0.571. Subsequently, similar event arrays are grouped based on thesimilarity between the event arrays and a label of the group is attachedto all the event arrays (S305). An event occurrence period from a firsttime to a final time of the event array and an interevent periodinserted between the event arrays are sequentially extracted from thesensor signal 102. The aforementioned cluster is acquired by theprocessing. The event occurrence period is classified into a modecorresponding to the label of the group and the intervening period isclassified into a mode corresponding to a combination of prior and postgroups (S306).

As described above, various operating states may be accurately dividedby using event information, a simple state may be achieved for eachindividual mode, and as a result, subsequent creation of the model inthe normal state may be performed with high accuracy.

A data processing method in learning by the feature amount extractionunit 105 and the normal-model creation unit 106 and ananomaly-measurement computation method in the anomaly-measurementcomputation unit 107 will be described with reference to FIGS. 4 to 7.

An example of the sensor signal 102 is shown in FIG. 4. The sensorsignal 102 is plural time-series signals and herein, shows 4 types ofsignals of a signal 1 corresponding to time-series/xx1, a signal 2corresponding to time-series/xx2, a signal 3 corresponding totime-series/xx3, and a signal 4 corresponding to time-series/xx4.Actually, the sensor signal is not limited to the 4 types and the signaltypes may be hundreds to thousands. The respective signals correspond tooutputs from plural sensors installed in the facility 101 and forexample, the temperatures of a cylinder, oil, cooling water, and thelike, or the pressure of the oil or the cooling water, a rotationalspeed of a shaft, a room temperature, an operating time, and the likeare measured at regular intervals. The sensor signal may include acontrol signal for controlling something with a predetermined value aswell as showing the output or state. In the present invention, the dataare treated as multi-dimensional time-series signals.

In FIG. 5, a normal model creation processing flow processed by usingthe feature amount extraction unit 105 and the normal-model creationunit 106 is shown. In the processing flow, first, the sensor signal 102is input into the feature amount extraction unit 105 (S501) andprocessing of feature amount extraction, conversion, and selection isperformed (S502). Subsequently, the processed data are input into thenormal-model creation unit 106 to select the learning data (S503), thelearning data are classified for each mode by referring to the modedividing information output from the mode dividing unit 104 (S504), andthe normal model is created for each mode (S505).

Subsequently, each step will be described in detail.

First, in step (S501), the feature amount extraction unit 105 inputs thesensor signal 102.

Subsequently, in step (S502), the feature amount extraction unit 105performs feature selection, feature amount extraction, and featureconversion and acquires the feature vector. Although not shown, thesensor signal 102 is accumulated in advance and uses a signal during apredetermined period as an input. Further, the event signal 103 is alsoaccumulated during the same period for dividing the mode.

In the feature selection, as minimum processing, a sensor signal havingvery small distribution and a sensor signal which increasesmonotonically need to be excluded. Further, deleting an invalid signalby a correlation analysis is also considered. This is a method in whicha correlation analysis is performed with respect to themulti-dimensional time-series signals and when similarity is very highin terms of plural signals of which correlation values are close to 1,redundant signals are deleted from the plural signals due to redundancyand non-redundant signals are left. Besides, a user may designate thesignals to be excluded. The selected sensor is stored to use the samesensor signal in evaluation.

The feature amount extraction is considered using the sensor signal asit is. A window of ±1, ±2, etc., is set with respect to a predeterminedtime and a feature indicating a time variation of data may be extractedby a feature vector of a window width (3, 5, etc.,)×the number ofsensors. Further, the feature may be resolved into a frequency componentby performing discrete wavelet transform (DWT). Further, each featuremay be subjected to canonicalization of transforming means so as to themean and the distribution be 0 and 1, respectively, by using the meanand the standard deviation. The mean and the standard deviation of eachfeature are stored so as to perform the same transformation inevaluation.

Alternatively, normalization may be performed by using a maximum valueand a minimum value or predetermined upperlimit value and lowerlimitvalue. The processing is used to treat sensor signals having differentunits and scales simultaneously.

In the feature conversion, various techniques including principalcomponent analysis (PCA), independent component analysis (ICA),non-negative matrix factorization (NMF), projection to latent structure(PLS), canonical correlation analysis (CCA), and the like are used andany technique may be used or the techniques may be combined and used,and the conversion may not be performed. It is easy to use the principalcomponent analysis, the independent component analysis, and thenon-negative matrix factorization because setting a target variable isnot required. Parameters such as a conversion matrix required forconversion are stored to achieve the same conversion as the conversionat the time of creating the normal model in evaluation.

Subsequently, in step S503, data of which the feature is converted isinput into the normal-model creation unit 106 and the learning data isselected in the normal-model creation unit 106. First, since there is acase that the acquired multi-dimensional time-series signal is partlylost, such data is deleted. For example, when most sensor signals output0 simultaneously, all signal data at a corresponding time are deleted.Subsequently, signal data which is anomalistic is removed. Specifically,a time when a warning or a failure occurs is examined from the eventsignal 103 and all signal data of the cluster (periods sequentiallyextracted in the aforementioned mode dividing) including the time areremoved.

Subsequently, in step S504, the normal-model creation unit 106classifies the learning data selected in step S503 for each of the modesdivided by the mode dividing unit 104 and creates the normal model foreach mode in step S505.

As a normal model creation technique, a projection distance method (PDM)or a local sub-space classifier (LSC) is considered. The projectiondistance method is a method of creating a partial space having a uniqueorigin point with respect to the learning data, that is, an affinepartial space (a space having maximum distribution). The affine partialspace is created for each cluster as shown in FIG. 6. In the figure, anexample in which a 1D affine partial space is created in a 3D featurespace is shown, but the dimension of the feature space may be furtherhigher and the dimension of the affine partial space may also be anydimension as long as the dimension of the affine partial space issmaller than the feature space and smaller than the number of thelearning data.

A computation method of the affine partial space will be described.First, the mean μ and the covariance matrix Σ of the learning data areobtained and subsequently, an eigenvalue problem of Σ is solved to setas an orthonormal basis of the affine partial space a matrix U in whicheigenvectors corresponding to r predetermined eigenvalues are arrayedfrom the larger eigenvalue. The anomaly measurement computed by theanomaly-measurement computation unit 107 is defined as a minimum valueof d which is a projection distance to the affine partial space of eachcluster that belongs to the same mode as evaluation data obtained fromthe sensor signal 102 through the feature amount extraction unit 105.Herein, instead of creating the affine partial space for each cluster,all of the clusters of the same mode may be collected to create theaffine partial space. According to this method, the number of times ofcalculating the projection distance may be small and the anomalymeasurement may be computed at a high speed. Further, the anomalymeasurement is basically computed in real time.

Meanwhile, the local sub-space classifier is a method of creating ak−1-dimensional affine partial space by using k-approximate data ofevaluation data q. An example of a case in which k=3 is shown in FIG. 7.As shown in FIG. 7, since the anomaly measurement is expressed by theprojection distance shown in the figure, a point b on the affine partialspace which is the closest to the evaluation data q may be obtained. Inorder to compute b from the evaluation data q and the k-approximate dataxi (i=1 . . . , k), from a matrix Q in which k qs are arrayed and amatrix X in which xi is arrayed,

C=(Q−X)^(T)(Q−X)  (Equation 2)

a correlation matrix C is obtained by Equation 2.

$\begin{matrix}{b = \frac{C^{- 1}1_{n}}{1_{n}^{T}C^{- 1}1_{n}}} & ( {{Equation}\mspace{14mu} 3} )\end{matrix}$

b is calculated by Equation 3.

In this method, since the affine partial space cannot be created if theevaluation data is not input, the normal-model creation unit 106performs the selection of the learning data and the data classificationfor each mode shown in FIG. 5, and further, constructs a kd tree forefficiently finding the k-approximate data for each mode. The kd treerepresents a spatial division data structure of classifying points in ak-dimensional Euclidean space. Dividing is performed by using only avertical plane in one coordinate axis and one point is configured to bestored in each leaf node. The anomaly-measurement computation unit 107acquires the k-approximate data of the evaluation data by using the kdtree that belongs to the same mode as the evaluation data, acquires theabove point b therefrom, and computes a distance between the evaluationdata and the point b to be used as the anomaly measurement.

Besides, the normal model may be created by using various methodsincluding Mahalanobis Taguchi method, a regression analysis method, anearest method, a similarity base model, a 1 class SVM, and the like.

Subsequently, a method of checking sufficiency of the learning data inthe learning-data check unit 108 will be described by using FIGS. 8 and9. FIG. 8 illustrates an example in which the anomaly measurement iscomputed by using the aforementioned projection distance method based onthe sensor signal 102 and the event signal 103. A graph 801 illustratesthe anomaly measurement, a graph 802 illustrates the number of times offailure occurrences, and a horizontal axis illustrates the time. It canbe seen that the failure occurs and the anomaly measurement increases atthe time of 803. However, the anomaly measurement increases even inother ranges, and as a result, it is difficult to determine thethreshold to prevent a false report from being output.

The anomaly measurement increases in spite of the normal state during atransient period from one normal state to the other normal state of the‘start’ mode or ‘stop’ mode. That is, since the learning data isinsufficient, the state of the mode is not sufficiently expressed.Therefore, the sufficiency of the learning data is acquired for eachmode, and as a result, the threshold may be determined for each mode.

The sufficiency is checked by, for example, cross validation of thelearning data. The cross validation is a method called a k-fold crossvalidation. Data is divided into k groups, the model is created with onegroup among them as the evaluation data and the other groups as thelearning data, and the anomaly measurement is computed. When the sameprocessing is performed with respect to all the k groups while changingthe evaluation data, the anomaly measurement may be computed withrespect to all data. Herein, a model of which k is larger may be closeto all learning data models and since a calculation time is extended,appropriate k needs to be selected.

When the anomaly measurement is computed with respect to all data, afrequency distribution (histogram) of the anomaly measurement is createdfor each mode. An accumulation histogram is created based thereon and avalue which reaches a ratio close to 1 which is designated in advance isacquired. As the value is larger, the learning data may be insufficient.The threshold is determined for each mode by processing such as addingan offset to the value or multiplying the value by a constant factor.The identification unit 109 judges the anomaly when the anomalymeasurement is equal to or more than the threshold as determined above.

FIG. 9 is an example of a GUI associated with checking the learningdata. A signal display screen, a feature display screen, a signalenlargement display screen, a feature enlargement display screen, ananomaly measurement display screen, and an anomaly measurementaccumulation histogram screen are changed by selecting a menu (selectinga tab displayed in the upper part of each screen).

The signal display screen 901 is shown in FIG. 9A. The signal displayscreen 901 is constituted by plural signal display windows 902 and thesensor signal 102 during a period designated as the learning data inadvance is displayed in each window as time-series data for each sensor(for each signal). The period of the learning data is displayed on aperiod display window 903 and may also be designated through the window.That is, the period to be displayed is designated by a period displaywindow to click a period designation button 912, thereby switching anddisplaying data during a period displayed on the signal display window902 at present to data during a designated period. The display ornon-display of each window 902 is selectable by a minimization button904 or a maximization button 905 and a display order is changeable by adrag-and-drop operation. In FIG. 9A, signals from 1 to 4 are maximizedand signals from 5 to 7 are minimized. A cursor 906 indicates an originpoint in enlarged display and may move by operating a mouse and akeyboard.

A feature display screen 907 is shown in FIG. 9B. The feature displayscreen 907 is constituted by plural feature display windows 908 and thefeature vector output from the feature amount extraction unit 105 isdisplayed on each window as the time-series data for each dimension. Theselection of the display or non-display and the operating of the displayorder are the same as those in the signal display screen 901. A cursor909 is displayed at the same time as the cursor 906 of the signaldisplay screen 901 and may move on this screen.

The signal enlargement display screen 910 is shown in FIG. 9C. Thesignal enlargement display screen 910 is constituted by plural signalenlargement display windows 911. On each window, the enlargement displayof the signal is performed on the signal display screen 901 as the timeindicated by the cursor 906 as an origin point. The display ornon-display of the signal and the display order are the same as those inthe signal display screen 901. On the period designation window 912, aperiod from the origin point to an end point of the display isdesignated by the time unit or daily unit. The origin point of thedisplay is changeable by a scroll bar 913 and the change is reflected tothe positions of the cursor 906 and the cursor 909. A total length of ascroll bar display area 9131 corresponds to a period designated by theperiod display window 903 of the signal display screen 901 or thefeature display screen 907. Further, the length of the scroll bar 913corresponds to the period designated by the period designation window912 and a left end of the scroll bar 913 corresponds to an origin pointof each signal displayed on the signal enlargement display window 911.Modes showing the aforementioned operating states are displayed withdifferent colors by the mode on a mode display unit 914 simultaneously.Although the feature enlargement display screen is not shown,information displayed on the feature display screen 907 is displayedsimilar to the signal enlargement display screen 910.

The anomaly measurement display screen 915 is shown in FIG. 9D. Theanomaly measurement display screen 915 is constituted by an anomalymeasurement display window 916 and an anomaly measurement enlargementdisplay window 917. The anomaly measurement computed by cross-validationis displayed in the anomaly measurement display window 916. A cursor 918is synchronized with the cursor 906 and the cursor 909 and is movableeven on this screen. On the anomaly measurement enlargement displaywindow 917, same with the signal enlargement display screen 910, anenlarged anomaly measurement is displayed at the time indicated by thecursor 918 as an origin point. A threshold 924 is overlaid on theanomaly measurement enlargement display window 917. A period designationwindow 919 and a scroll bar 920 also perform the same operations asthose of the signal enlargement display screen 910.

An anomaly measurement accumulation histogram screen 921 is shown inFIG. 9E. The anomaly measurement accumulation histogram screen 921includes histogram display windows 922 as many as the number of modesand a parameter display screen 923. An accumulation histogram of anomalymeasurement for each mode is displayed on the histogram display window922 and thresholds computed according to parameters displayed on theparameter display screen 923 are expressed by dotted lines 924-1 to 4.The thresholds are used to identify anomaly in the identification unit109.

The parameters displayed on the parameter display screen 923 include theratio for defining a reference value, the offset used for computing thethresholds, and a constant factor for magnification in the thresholdcomputation method described as above. The parameters can be changed onthe parameter display screen 923 and the thresholds displayed on thehistogram display window 922 and the anomaly measurement enlargementdisplay window 917 are changed with the change of the parameters.

Since the sensor signal, the extracted feature, the mode, the anomalymeasurement, and the threshold can be visually verified by the GUIdescribed as above, it can be judged whether the model is good or bad,and as a result, a good normal model can be created.

Subsequently, the processing in the anomaly diagnosis unit 110 will bedescribed.

FIGS. 10A and 10B illustrate a causal relationship learning method inthe anomaly diagnosis unit 110. First, a sequence of creating a matrix1020 shown in FIG. 10B will be described by using a flowchart of FIG.10A. First, a sensor signal 102 and an event signal 103 during apredetermined period are input into the anomaly diagnosis unit 110(S1001 and S1011). Since many cases in which a failure occurs need to belearned, a period longer than the learning data for creating the normalmodel is required. The number of the cases may be increased by usingdata of plural devices. Subsequently, a failure event is extracted fromthe event signal 103 (S1002) to create a result event list (S1003).‘Nothing occurs’ is added to the result event list.

Meanwhile, anomaly is identified according to the aforementioned anomalyidentification method based on the sensor signal 102 and the eventsignal 103 (S1012). After the anomaly measurement is computed by thecross-validation, the anomaly identification is performed by using athreshold computed by an appropriate parameter. Alternatively, theanomaly identification is performed by using a normal model and athreshold learned by using additional data in advance. A feature vectorat the time of judging anomaly is picked up (S1013) and vector-quantizedby adopting an unsupervised clustering technique such as a k-meansmethod or an EM algorithm (S1014). In the vector quantization, similarvectors are gathered and grouped and an average thereof is computed as arepresentative vector of the group. A label representing the group isattached to each representative vector. A list is created with thevector attached with the label as a cause event (S1015).

Subsequently, a frequency matrix 1020 with a horizontal axisrepresenting a result event and a vertical axis representing the causeevent is created (S1020). When the learning data is created by using thefrequency matrix 1020, first, all elements of the matrix are reset to 0.The anomaly measurement is scanned according to a time series and anoccurrence time of anomaly over the threshold is examined. The time ofrecognizing the casual relationship is designated in advance and theevent signal 103 between the anomaly occurrence time and the passage ofthe designated time is examined and a failure event is extracted. Thenearest representative vector is acquired from the sensor signal 102 atthe anomaly occurrence time or the feature amount extracted basedthereon. Crossing elements of the acquired representative vector and theextracted failure event are counted up. When no failure event isextracted, crossing elements of the representative vector and ‘Nothingoccurs’ are counted up. This operation is performed throughout an entiredesignate period. Further, the frequency of each representative vectoris also examined.

Subsequently, a flow of processing in evaluation will be described byusing FIG. 10C. First, the sensor signal 102 is input into the featureamount extraction unit 105 (S151) and the event signal 103 is input intothe mode dividing unit 104 (S152) to perform the anomaly identificationby using the anomaly identification unit 109 as described above (S153).The distance between the feature vector at the time of anomaly judgmentand each of the representative vectors is examined and a cause event Xcorresponding to the nearest vector is extracted (S154). A row on thefrequency matrix 1020 corresponding to the cause event X is examined,result events Y1, Y2, Y3, etc. are extracted, in the order of a highfrequency (S155), and the extracted results are presented (displayed onthe screen) (S156). The presentation is an advance notice indicatingthat the result events may occur. Simultaneously, by dividing eventsincluding the cause event X which presents the result events Y1, Y2, Y3,etc., by the frequency of the cause event X as occurrence probabilitiesof the result events. Further, the frequency matrix 1005 may be updatedbased on data at the time when the anomaly occurs in evaluation.Further, the diagnosis processing is basically performed in real time.

In the diagnosis, it is important to present the cause event to beeasily appreciated. That is, it needs to describe which state the sensorsignal has the anomaly. To do so, a normal signal and an actual signalmay be displayed overlapping with each other with respect to thepredetermined prior and post time. For example, in the case where theanomaly measurement is computed by the projection distance method or thelocal sub-space classifier, coordinates (FIG. 6 and b of FIG. 7) below avertical line in the affine partial space are displayed as the normalsignal from the evaluation data. The signal is displayed as thetime-series information to easily verify that the anomaly measurement isdeviated from the normal state. Further, since it is considered that asignal having a large deviation when the anomaly occurs contributes tothe anomaly judgment, when the signals are displayed in the order of thelarge deviation from the top, it is easily verified which sensor signalhas the anomaly. In addition, when a past case of the cause event isdisplayed in the same manner as the presented result event, it is easyto accept the same phenomenon to trust the advance notice of the resultevent.

Accordingly, the sensor signal is quantized after the anomaly isdetected based on the sensor signal 102, and as a result, information isnarrowed to be used as an input of the matrix and learning the casualrelationship between the events is implemented. In the learning of thecasual relationship, the result events are counted up a predeterminedtime after the cause event occurs to extract even a casual relationshiphaving a temporal difference and predict the failure based on the resultevents. That is, a prior warning of the failure can be detected.

The frequency matrix 1005 of the cause event and the result eventsacquired herein may be used to check the sufficiency of the learningdata in addition to the diagnosis. Specifically, a signal vector havingthe high occurrence frequency and the high probability that ‘Nothingoccurs’ is examined and a threshold of the case associated therewith isincreased.

As described above, the prediction of the failure occurrence after theanomaly detection has been described, but the time up to the failureoccurrence may be predicted by additional processing. A time differencematrix of the same cause event and result event is created when thefrequency matrix 1005 is created. However, a column indicating ‘Nothingoccurs’ is deleted. First, all elements are reset to 0. When the failureevent is extracted between the anomaly occurrence time and the passageof the designated time, the passage time from the anomaly occurrencetime is computed and the computed passage time is added to a crossingelement of the cause event and the extracted failure event thatcorrespond to each other. As a result, the sum of times from theoccurrence of the cause event to the occurrence of the result events iscomputed in a case in which a predetermined result occurs due to apredetermined event. In evaluation, the cause event is specified afterthe anomaly is detected and the elements of the time difference matrixare divided by the frequency with respect to the result events extractedbased on the frequency matrix to acquire a performance average of thetime difference among the events. The presentation of the time is, i.e.,the prediction of the occurrence time.

Hereinafter, as a modified example of the processing method described inFIG. 10A, an embodiment of an anomaly diagnosis method without using thesensor signal 102 will be described by using FIG. 11. FIG. 11 is a flowof anomaly diagnosis processing based on only the event signal 103. Inlearning, the event signal 103 during a predetermined period is inputinto the anomaly diagnosis unit 110 (S1101). Since many cases in whichthe failure occurs need to be learned, a period which is as long aspossible is set. The number of the cases may be increased by using dataof plural devices. Subsequently, a failure event 1001 is extracted fromthe event signal 103 (S1102) and a result event list is created byadding ‘Nothing occurs’ (S1103). Meanwhile, all kinds of events areextracted from the event signal 103 (S1104) and a cause event list iscreated (S1105).

Subsequently, a frequency matrix 1120 with a horizontal axisrepresenting a result event 1103 and a vertical axis representing acause event 1115, which is shown in FIG. 11B, is created (S1106). Whenthe learning data is created by using the frequency matrix 1120, first,all elements of the matrix are reset to 0 and the event signal 103 issequentially processed according to the time series, similarly as thecase described in FIG. 10B.

The time of recognizing the casual relationship is designated in advanceand a failure event which occurs between the occurrence of apredetermined event and the passage of the designated time is extracted.Crossing events of the former event, i.e., the cause event and theextracted failure event are counted up. When no failure event isextracted, crossing elements of the cause event and ‘Nothing occurs’ arecounted up. This processing is performed with respect to all eventsignals 103 which are input. Further, the frequency of each event isalso examined.

In evaluation, the event signal 103 is acquired in real time andimmediately processed. When the event, i.e., the cause event X occurs, arow corresponding to the frequency matrix is examined and the resultevents Y1, Y2, Y3, etc., are presented in the order of the highfrequency together with the occurrence probability. According to themethod, the occurrence of the failure may be predicted only by analyzingthe event signal 103.

In the above description, the event signal is automatically output bythe device, but as the result event of the frequency matrix 1005 of thecause event and the result event, an item of a problem identified in aregular check may be used together. Further, data including an image,sound, smell, vibration, and the like acquired in the regular check asthe cause event may be quantized and used.

Further, when facility as a state monitoring target is a device such asan image diagnosis device, a measurement device, or a manufacturingdevice, which is intermittently used, data acquired in use may be thecause event or result event. For example, when the facility is the imagediagnosis device, the facility is classified into a predeterminedcategory based on a problem and image quality of the acquired image.When the facility is the measurement device, a reference material isregularly measured and the result is quantized. When the facility is themanufacturing device, the doneness of an intermediate manufacture afterprocessing is classified into a predetermined category according to aninspection or measurement result.

Second Embodiment

FIG. 12A illustrates a configuration example of a second embodimentregarding a system that implements a method for monitoring the state ofa facility of the present invention.

In this system, the sensor signal analysis unit 100 described in FIG. 1Aof the first embodiment is modified into a sensor signal analysis unit1200 shown in FIG. 12A.

The sensor signal analysis unit 1200 is configured to include a featureamount extraction unit 1201 receiving a sensor signal 102 output fromfacility 101 to perform feature amount extraction of the signal andacquire a feature vector, a feature-selection unit 1202 performingfeature selection by receiving an output of the feature amountextraction unit 1201, a learning-data selecting unit 1203 selectinglearning data to use by receiving an output of the feature-selectionunit 1202, a normal-model creation unit 1204 creating a normal model byreceiving an output of the learning-data selecting unit 1203, ananomaly-measurement computation unit 1205 using the normal model createdby the normal-model creation unit 1204 and computing an anomalymeasurement from a feature vector acquired through the feature amountextraction unit 1201 and the feature-selection unit 1202, alearning-data check unit 1206 checking the normal model based on theanomaly measurement computed by the anomaly-measurement computation unit1205 with respect to the normal model created by the normal-modelcreation unit 1204, and an anomaly identification unit 1207 identifyingan anomaly based on the anomaly measurement computed from data of thenormal model checked by the learning-data check unit 1206 and thefeature vector acquired from the sensor signal 102 through the featureamount extraction unit 1201 and the feature-selection unit 1202 by usingthe anomaly-measurement computation unit 1205.

A flow of processing in learning by the system will be described byusing FIG. 12B. The learning time indicates off-line processing ofcreating a model used for anomaly prior-warning detection in advance.

The sensor signal 102 output from the facility 101 is accumulated forlearning in advance although not shown. The feature amount extractionunit 1201 inputs the accumulated sensor signal 102 (S1201) and performsfeature amount extraction to acquire the feature vector (S1202).

The feature-selection unit 1202 performs data check of the featurevector output from the feature amount extraction unit 1201 and selects afeature to be used (S1203).

The learning-data selecting unit 1203 performs data check of the featurevector configured by the selected feature and selects the learning dataused to create the normal model (S1204). The selected learning data isdivided into k groups (S1205), the groups except for one group amongthem are input into the normal-model creation unit 1204 and thenormal-model creation unit 1204 performs learning by using the inputgroups and creates the normal model (S1206).

The anomaly-measurement computation unit 1205 uses the created normalmodel and computes the anomaly measurement by inputting data of the onegroup excluded in step S1206 (S1207). If the computation of the anomalymeasurement for data of all the groups is not terminated (S1208), thesteps of the normal model creation (S1206) and the anomaly measurementcomputation (S1207) are repeated with respect to other groups (S1209).If the computation of the anomaly measurement for the data of all thegroups is terminated (S1208), the process proceeds to the next step.

The learning-data check unit 1206 sets a threshold for identifying theanomaly based on the anomaly measurement computed with respect to thedata of all the groups (S1209). The normal-model creation unit 1204performs learning by using all selected learning data and creates thenormal model (S1210).

Subsequently, a flow of processing in evaluation by the system will bedescribed by using FIG. 12C. The meaning of in evaluation indicatesprocessing of performing anomaly prior-warning detection based on themodel created by learning and an input signal. The processing isbasically performed on-line, but the processing may be performedoff-line.

The feature amount extraction unit 1201 inputs the sensor signal 102(S1212) and performs the same feature amount extraction as that at thelearning time to acquire the feature vector (S1213).

The feature-selection unit 1202 creates a feature vector configured bythe feature selected in learning based on the feature vector output fromthe feature amount extraction unit 1201 (S1214).

The feature vector created by the feature-selection unit 1202 is inputinto the anomaly-measurement computation unit 1205 to compute theanomaly measurement by using the normal model created by thenormal-model creation unit 1204 in learning (S1210) (S1215). Thecomputed anomaly measurement is input into the anomaly identificationunit 1207 and compared with the threshold set in learning (S1209) toperform the anomaly judgment (S1216).

Subsequently, operations of individual components shown in FIG. 12A willbe described in detail sequentially.

It is considered that the feature amount extraction in the featureamount extraction unit 1201 uses the sensor signal as it is. It isconsidered that a window of ±1, ±2, etc., is installed with respect to apredetermined time and a feature indicating a time variation of data maybe extracted by a feature vector of a window width (3.5, etc.,)×thenumber of sensors. Further, the feature may be resolved into a frequencycomponent by performing discrete wavelet transform (DWT). Further, eachfeature may be subjected to canonicity of transforming the mean and thedistribution to 0 and 1, respectively by using the mean and the standarddeviation. The mean and the standard deviation of each feature arestored so as to perform the same transformation in evaluation.Alternatively, normalization may be performed by using a maximum valueand a minimum value or predetermined upperlimit value and lowerlimitvalue.

A first example of the feature selection processing in learning, in thefeature-selection unit 1202 will be described. This processing is toexclude a feature which causes the precision of the normal model to bedeteriorated. In this point, it is considered that a feature in whichlong-time variation is large is excluded. When the feature in which thelong-term variation is large is used, the number of normal states isincreased and insufficient learning data is generated. Herein, since alarge variation which is caused just by a difference of an operatingstate will occurs in most features, such feature is not a target to beexcluded. Therefore, data is checked every one operating cycle of thefacility to remove an influence of variation by the difference in theoperating state.

Specifically, the mean and distribution of all the learning data arecomputed every one-cycle period for each feature and features having alarge variation thereof are excluded. However, data during a period inwhich it is known in advance that the anomaly occurs is not a target tobe considered. FIG. 13 illustrates an example in which the mean anddistribution are computed and plotted every one day. In this example,feature A is stable in both the mean and the distribution, while sincefeature B is large in a variation, feature B is preferably excluded. Asdescribed above, when the operating cycle is regular, e.g., theoperation starts and stops at the determined time of one day, data isextracted every fixed period, e.g., one day to compute the mean and thedistribution. Although the period is not one day, the same appliesthereto. When the operation starting/stopping time is known, data in aperiod which can be regarded as a normal operation is carried out may beextracted to compute the mean and the distribution and this method maybe applied even though the operating cycle is irregular.

Subsequently, a second example of the feature selection processing inlearning will be described. The second embodiment is a method in which awaveform model for one cycle is created and the number of times ofdeviation from the model is checked. When the operating cycle isregular, wavelengths for one cycle are superimposed for each featurewith respect to all learning data. The mean μ(t) and the distributionσ(t) of each waveform at xi(t) are computed according to the followingequation and a range other than the range of σ(t)±σ(t) is counted as thedeviation.

$\begin{matrix}{{{\mu (t)} = {\frac{1}{n}{\sum\limits_{i = 1}^{n}{x_{1}(t)}}}}{{\sigma (t)} = \sqrt{{\frac{1}{n}{\sum\limits_{i = 1}^{n}( {x_{1}(t)} )^{2}}} - ( {\mu (t)} )^{2}}}} & ( {{Equation}\mspace{14mu} 4} )\end{matrix}$

The number of times of deviation Ci of the waveform xi(t) is expressedby the following equation.

$\begin{matrix}{{{Ci} = {\sum\limits_{t = 1}^{r}{\delta_{1}(t)}}}{{\delta \; {i(t)}} = \{ \begin{matrix}0 & {{{if}\mspace{14mu} {{{x_{1}(t)} - {\mu (t)}}}} \leq {k\; {\sigma (t)}}} \\1 & {else}\end{matrix} }} & ( {{Equation}\mspace{14mu} 5} )\end{matrix}$

An example of the waveform model is shown in FIG. 14. A horizontal axisrepresents a time, a vertical axis represents a feature value, μ(t) isplotted by a solid line, and μ(t)±σ(t) is plotted by dotted lines.

Even though the operating cycle is irregular, when the operationstarting/stopping time is known, the operation starting time and theoperation stopping time are added up and thereafter, a period which canbe regarded as the normal operation and a period which can be regardedas complete stop are extended and superimposed to compute the mean μ(t)and the distribution σ(t), similar to the case when an operating cycleis regular. Even at the time of examining the number of times ofdeviation, the waveform is extended and superimposed by adding up theoperation starting time and the operation stopping time.

A feature to be excluded is generally high in the number of times ofdeviation. For example, when a ratio of the mean and the distribution ofthe number of times of deviation (mean/distribution) is low, it may bejudged that the number of times of deviation is generally high.Alternatively, even when a ratio of the mean of the features acquired byexcluding a predetermined number of features from the features havingthe higher number of times of deviation and the mean of all the featuresis high, it may be judged that the number of times of deviation isgenerally high. The judgment may be performed by an appropriatethreshold by computing the mean and the distribution.

Subsequently, a third example of the feature selection processing inlearning will be described by using FIGS. 15 and 16. In this example,information indicating whether the state at each time is normal oranomalistic is added to the accumulated sensor signal 102. This is amethod of attaching a label indicating whether the state is normal oranomalistic to data before or after a warning or a failure occurs basedon the event signal 103 although not shown.

The method is shown in FIG. 15. A horizontal axis represents a time andprimarily represents a time T0 at which the warning or failure occurs.The anomaly label is attached to data of a time between predeterminedtimes t1 after or before T0. The label is not attached to a period froma time T0−t1 to t2 and a period from a time T0+t1 to t2. The normallabel is attached to a period before a time T0−t1−t2 and a period afterT0+t1+t2. When the warning or failure closely occurs, the label isattached based on each warning or failure occurrence time and at thetime of attaching plural labels, the attachment order of the labels isdetermined in the priority order of anomalistic, no label, and normal.By using sensor signal data attached with the labels as described above,optimization is performed based on a maximum evaluation value.

Herein, a computation method of the evaluation value will be describedbelow. First, the data attached with a normal label is used and thenormal model is created by using the same technique as the techniqueused by the normal-model creation unit 1204. Further, the data attachedwith the normal label is divided into k groups and the normal models arecreated with each one group excluded. As a result, k normal models arecreated. Subsequently, the anomaly measurement of the data attached withthe normal label is computed by using the same technique as thetechnique used by using the anomaly-measurement computation unit 1205 byusing the normal model created as the group not including the data. Arepresentative value Dn of the anomaly measurement of a normal part isacquired from the acquired anomaly measurement. As a method of acquiringDn, the mean, of all data, a maximum value, a value which reaches apredetermined ratio by arraying data in an ascending order, a maximumvalue after adding a minimum-value filter with a predetermined width andthe like are considered.

Subsequently, the anomaly measurement of the data attached with theanomaly label is computed by using the normal model created in all dataattached with the normal label. A representative value Df of the anomalymeasurement of an anomaly part is acquired from the acquired anomalymeasurement. As a method of acquiring Df, the mean of all data attachedwith the anomaly label, a maximum value, a value which reaches apredetermined ratio by arraying data in an ascending order, a minimumvalue, a maximum value after adding a minimum-value filter with apredetermined width, a minimum value after adding a maximum-value filterwith a predetermined width, the mean of data of a predetermined ratio ormore by arraying data in the ascending order, and the like areconsidered. In order to handle plural kinds of warnings or failures,they are computed for each of the consecutive periods attached with theanomaly label and a minimum value of the computed values in all theperiods is represented by Df. Lastly, a ratio of anomaly measurements ofthe normal part and the anomaly part (Df/Dn) is set as the evaluationvalue.

As an optimization technique, any one of a round-robin, a wrappermethod, random selection, a gene algorithm, and the like may be used. Asan example, a backward type wrapper method will be described by usingFIG. 16. This is a method which starts from all features and excludesone by one feature of which evaluation values are not deteriorated inspite of exclusion.

First, the method starts from using d of all features (S1601). Thenumber of the features in evaluation is set to n. An evaluation valueE(n) is computed through the method by using n features (S1602). Thefeatures are extracted one by one to compute n evaluation values(S1603). Subsequently, it is judged whether the evaluation values whichare equal to or more than E(n) exist (S1604). When the evaluation valuewhich is equal to or more than E(n) exists, one feature is extracted soas to have the highest evaluation value and the evaluation value is setas E(n−1) (S1605). 1 is subtracted from n (S1606) and the processreturns to step S1603.

When the evaluation value which is equal to or more than E(n) does notexist in step S1604, the just previously extracted feature is returned(S1607) and the features are extracted two by two to compute n×(n−1)evaluation values (S1608). It is judged whether the evaluation valueswhich are equal to or more than E(n) exist among these evaluation values(S1609). When the evaluation value which is equal to or more than E(n)exists, two features which cause the highest evaluation value areextracted and the highest evaluation value is set as E(n−1) (S1610). 1is subtracted from n (S1606) and the process returns to step S1603. Whenthe evaluation value which is equal to or more than E(n) does not existin step S1609, the process is terminated and the combination of thefeatures is adopted (S1611).

The wrapper method also includes a forward type. This method starts from0 and adds features having evaluation values increased one by one.

The learning data selection processing in the learning-data selectionunit 1203 will be described. This processing is to exclude anomaly datawhich should not be used to create the normal model. Therefore, data ischecked every one operating cycle of the facility to remove an influenceof variation by the difference in the operating state and thereafter,data during a period which is a deviation value is removed from thelearning data.

Specifically, the mean and distribution are computed every one-cycleperiod for each feature for all the learning data and the deviationvalue is found to remove data during a period corresponding to thedeviation value. FIG. 17 illustrates an example in which the mean anddistribution are computed and plotted every one day. Two kinds offeatures are plotted and data surrounding features C and D with circles,respectively are deviation values. In order to find the deviationvalues, hierarchical clustering is performed based on a distance anddata isolated in 1 or small number are found.

Besides, a method in which a waveform model for one cycle is created andthe number of times of deviation from the model is checked is alsoconsidered. In the same method as the second example of the featureselection, the mean μ(t) and the distribution σ(t) are computed and arange other than the range of μ(t)±kσ(t) is counted as the deviation.The mean of the number of times of deviation is computed for eachfeature and when the number of times of deviation for one cycle iscompared with and is extremely larger than (e.g., several times morethan) the mean with respect to a predetermined feature, data during thecorresponding period is removed. Alternatively, the number of featuresin which the number of times of deviation for one cycle is more than themean is counted and data during a period having the large number ofdeviation times is removed.

Another example of the learning data selection processing in thelearning-data selection unit 1203 will be described by using FIG. 18.First, the feature vector configured by the selected feature which isoutput from the feature-selection unit 1202 is input (S1801).Subsequently, input data is isolated every one cycle of the operatingcycle (S1802). When the operating cycle is unclear, a unit which is easyto handle, such as every day may be used.

Subsequently, data for one cycle are determined as a check target(S1803) and the normal model is created by randomly sampling data forseveral cycles from data other than the check target and repeatedlyperforming this process k1 times for k1 check target to create k1 models(S1804). The normal model creation technique is the same as thetechnique used in the normal-model creation unit 1204. Anomalymeasurements of the check targets are computed by using k1 normalmodels, respectively (S1805). As a result, k1 anomaly measurements arecomputed at each time. Subsequently, k2 anomaly measurements from thesmallest are selected among the k1 anomaly measurements at each time tocompute the mean, which is set as the anomaly measurement of thecorresponding time (S1806).

A maximum value of the means of the computed anomaly measurements duringone cycle is acquired and set as a representative value of the anomalymeasurements during the cycle (S1807). When computation of therepresentative value is not terminated with respect to all cycles(S1808), data of the next cycle is determined as the check target(S1809). Then, the processing from step S1804 is repeated. When thecomputation is terminated, data of a cycle having the largerepresentative value of the anomaly measurement is excluded from thelearning data (S1810).

In the example, plural normal models are created by random sampling, andas a result, it is expected that several models are created as data notincluding the anomaly even though the anomaly state is mixed into data.When the check target is normal, the anomaly measurement computed byusing the model created as the normal data is small, and as a result,the mean of several anomaly measurements selected from the smallest issmall. When the check target is anomalistic, the anomaly measurementcomputed by using a model created as data including the same anomaly issmall. But, when using several models, there is scarcely a case that allthe models include the anomaly. Therefore, the anomaly measurementincreases when the means is acquired. Under the assumption that the rateof mixed anomaly is low, anomalistic data may be excluded by thismethod.

According to the method described above, the feature and the learningdata which are used may be automatically selected based on data check ofthe feature vector. As a result, the user may create a high-precisionnormal model only by inputting the whole sensor signals without lookingover the used feature and learning data and high-sensitive anomalydetection is implemented with a minimum effort.

Further, in the example shown in FIG. 12A, only the sensor signal isused, but like the embodiment shown in FIG. 1A, the configuration inwhich the event signal is input, mode dividing is performed basedthereon, and the normal model is created for each mode and the thresholdis set by checking sufficiency of the learning data is also included inthe present invention.

In this case, it is considered that the event signal is used even inselection processing the learning data in the learning-data selectionunit 1203. Hereinafter, an example of the selection processing of thelearning data using the event signal will be described. A basic policyis to judge whether an anomaly state will be included as a predeterminedbasic unit based on the event signal and, if included, remove theanomaly state from the learning data by the basic unit including theanomaly state. The predetermined basic unit is, e.g., one day. This isdetermined from the two viewpoints of including various operating statesand removing the influence of the anomaly state with much time to spare.

The condition of judging the anomaly is, for example, as follows. Thecondition includes (1) occurrence of the failure or warning event, (2)including an anomalistic start sequence, (3) difference from others inthe number of start sequences, (4) difference from others in theinterval between the start sequence and the stop sequence, and (5)occurrence of an event or an event array having a low frequency.Checking (1) may only retrieve the failure/warning from the event signalto examine the time and date thereof. In order to check (2), (3), and(4), the start sequence and the stop sequence are extracted according tothe method described by using FIG. 2 and it is judged whether theextracting sequences are normal.

The normal sequence stops in a predetermined stop event. When thesequence stops in the failure or warning event or a start event of apredetermined sequence, the sequence is judged as the anomaly sequence.Further, it is judged whether the sequence is normal or anomalisticbased on a knowledge regarding the normal sequence such as the number ofpredetermined events, the order of the events, and the like among thesequences. In order to check (5), the frequency of the event or eventarray is examined in advance. However, the frequency of the event arraymay be counted to be the same as that of the similar event arrayaccording to the method shown in FIG. 3.

Third Embodiment

FIG. 19 illustrates one configuration example of a system thatimplements a method for monitoring the state of facility in the thirdembodiment.

The system monitoring the state of the facility of the embodiment isimplemented by combining a sensor-signal analysis unit 1900corresponding to the sensor signal analysis unit 1200 of FIG. 12described in the second embodiment and a mode dividing unit 1908corresponding to the mode dividing unit 104 described in the firstembodiment.

The system is configured to include the sensor signal analysis unit 1900including a feature amount extraction unit 1901 that receives a sensorsignal 102 output from facility 101 to perform feature amount extractionof the signal and acquires a feature vector, a feature-selection unit1902 performing feature selection by receiving an output of the featureamount extraction unit 1901, a learning-data selecting unit 1903selecting learning data to be used by receiving the event signal 103output from the facility 101 and an output of the feature-selection unit1902, a normal-model creation unit 1904 creating a normal model byreceiving an output of the learning-data selecting unit 1903, ananomaly-measurement computation unit 1905 using the normal model createdby the normal-model creation unit 1904 and computing an anomalymeasurement from the feature vector acquired through the feature amountextraction unit 1901 and the feature-selection unit 1902, alearning-data check unit 1906 checking the normal model based on theanomaly measurement computed by the anomaly-measurement computation unit1905 with respect to the normal model created by the normal-modelcreation unit 1904, and an anomaly identification unit 1907 identifyingan anomaly based on the anomaly measurement computed from data of thenormal model checked by the learning-data check unit 1906 and thefeature vector acquired from the sensor signal 1905 through the featureamount extraction unit 1901 and the feature-selection unit 1902 by usingthe anomaly-measurement computation unit 1905, and the mode dividingunit 1908 dividing the time according to the variation in the operatingstate of the facility 101 by receiving the event signal 103 output fromthe facility 101.

A flow of processing in learning by the system will be described.

The sensor signal 102 output from the facility 101 is accumulated forlearning in advance. The feature amount extraction unit 1901 inputs theaccumulated sensor signal 102 and performs feature amount extraction toacquire the feature vector. The feature-selection unit 1902 performsdata check of the feature vector output from the feature amountextraction unit 1901 and selects a feature to be used. The learning-dataselecting unit 1903 performs data check of the feature vector configuredby the selected feature and check of the event signal 103 and selectsthe learning data used to create the normal model.

Meanwhile, the mode dividing unit 1908 performs mode dividing ofdividing the time for each operating state based on the event signal103. The selected learning data are divided into k groups, the groupsexcept for one group among them are input into the normal-model creationunit 1904 and the normal-model creation unit 1904 performs learning byusing the input groups and creates the normal model. In the case of somenormal model types, the normal model is created for each mode.

The anomaly-measurement computation unit 1905 uses the created normalmodel and computes the anomaly measurement by inputting data of the onegroup excluded in creating the normal model. If the computation of theanomaly measurement for data of all the groups is not terminated, thenormal model creation and the anomaly measurement computation arerepeated with respect to other groups. If the computation of the anomalymeasurement for the data of all the groups is terminated, the processproceeds to the next step. The learning-data check unit 1906 sets athreshold for identifying the anomaly for each mode based on the anomalymeasurement computed with respect to the data of all the groups.

The normal-model creation unit 1904 performs learning by using allselected learning data and creates the normal model.

Subsequently, a flow of processing in evaluation by the system will bedescribed.

The feature amount extraction unit 1901 inputs the sensor signal 102 andperforms the same feature amount extraction as that at the learning timeto acquire the feature vector. The feature-selection unit 1902 createsthe feature vector configured by the feature selected in learning basedon the feature vector output from the feature amount extraction unit1901. The feature vector created by the feature-selection unit 1902 isinput into the anomaly-measurement computation unit 1905 to compute theanomaly measurement by using the normal model created by thenormal-model creation unit 1904 in learning.

When the normal model is created for each mode, the anomaly measurementis computed by using the normal models of all the modes and the minimumvalue is acquired. Meanwhile, the mode dividing unit 1908 performs modedividing of dividing the time for each operating state based on theevent signal 103. The computed anomaly measurement is input into theanomaly identification unit 1907 and compared with the threshold for thecorresponding mode among the thresholds for each mode set in learning tojudge the anomaly.

Subsequently, operations of individual components shown in FIG. 19 willbe described in detail sequentially.

The mode dividing method in the mode dividing unit 1908 is the same asthe method described by using FIGS. 2 and 3.

The operations in the feature amount extraction unit 1901 and thefeature-selection unit 1902 are the same as the example described byusing FIG. 12.

In the learning data selection processing in the learning-data selectionunit 1903, the method using the event signal is considered in additionto the same method as the example described by using FIG. 12. An exampleof the learning data selection processing using the event signal will bedescribed. A basic policy is to judge whether an anomaly state will beincluded as a predetermined basic unit based on the event signal and, ifincluded, remove the anomaly state from the learning data by the basicunit including the anomaly state. The predetermined basic unit is, e.g.,one day. This is determined from the two viewpoints of including variousoperating states and removing the influence of the anomaly state withmuch time to spare.

The condition of judging the anomaly is, for example, as follows. Thecondition includes (1) occurrence of the failure or warning event, (2)including an anomalistic start sequence, (3) difference from others inthe number of start sequences, (4) difference from others in theinterval between the start sequence and the stop sequence, and (5)occurrence of an event or an event array having a low frequency.Checking (1) may only retrieve the failure/warning from the event signalto examine the time and date thereof. In order to check (2), (3), and(4), the start sequence and the stop sequence are extracted according tothe method described by using FIG. 2 and it is judged whether theextracted sequences are normal.

The normal sequence stops in a predetermined stop event and when thesequence stops in the failure or warning event or a start event of apredetermined sequence, the sequence is judged as the anomaly sequence.Further, it is judged whether the sequence is normal based on aknowledge regarding the normal sequence such as the number ofpredetermined events, the order of the events, and the like among thesequences. In order to check (5), the frequency of the event or eventarray is examined in advance. However, the frequency of the event arraymay be counted to be the same as that of the similar event arrayaccording to the method shown in FIG. 3.

The normal model creating method processed by the normal-model creationunit 1904 is the same as the method described by using FIGS. 5 to 7.

The anomaly measurement computation method processed by theanomaly-measurement computation unit 1905 is the same as the methoddescribed by using FIGS. 6 and 7.

The learning data check method processed by the learning-data check unit1906 is the same as the method described by using FIGS. 8 and 9.

INDUSTRIAL APPLICABILITY

The present invention can be used in a method and a device formonitoring the state that even in a turbine in a hydroelectric plant, anuclear reactor in a nuclear power plant, a windmill of a wind powerplant, an engine of an aircraft or a heavy machine, a railroad vehicleor a track, an escalator, an elevator, and an apparatus/component levelin addition to a gas turbine or a stream turbine, facilities such as thedeterioration/lifespan of mounted batteries are numerous, diagnose aphenomenon by detecting an anomaly early based on multi-dimensionaltime-series data output from various facilities.

REFERENCE SIGNS LIST

-   101 . . . Facility-   102 . . . Sensor signal-   103 . . . Event signal-   104 . . . Mode dividing unit-   105 . . . Feature amount extraction unit-   106 . . . Normal-model creation unit-   107 . . . Anomaly-measurement computation unit-   108 . . . Learning-data check unit-   109 . . . Anomaly identification unit-   110 . . . Anomaly diagnosis unit-   1201 . . . Feature amount extraction unit-   1202 . . . Feature-selection unit-   1203 . . . Learning-data selecting unit-   1204 . . . Normal-model creation unit-   1205 . . . Anomaly-measurement computation unit-   1206 . . . Learning-data check unit-   1207 . . . Anomaly identification unit

1. A method for monitoring the state of facility that detects an anomalybased on a time-series sensor signal output from the facility or anapparatus, comprising: a learning process of extracting a feature vectorbased on the sensor signal, selecting a feature to be used based on datacheck of the feature vector, selecting learning data to be used based ondata check of the feature vector, creating a normal model based on theselected learning data, checking sufficiency of the learning data usedfor creating the normal model, and setting a threshold in accordancewith the sufficiency of the learning data; and an anomaly detectingprocess of extracting the feature vector based on the sensor signal,computing an anomaly measurement through the comparison between thenormal model and the feature vector, and identifying the anomaly throughthe comparison between the anomaly measurement and the threshold.
 2. Themethod for monitoring the state of facility according to claim 1,wherein the data check in selecting the feature and selecting thelearning data is performed based on the mean and distribution for oneoperating cycle for each feature of the feature vector.
 3. The methodfor monitoring the state of facility according to claim 1, wherein thedata check in selecting the feature and selecting the learning data isperformed based on the number of times of deviation from a waveformmodel for one operating cycle for each feature of the feature vector. 4.The method for monitoring the state of facility according to claim 2,wherein the feature is selected by inputting information on a warning orfailure time of the facility or apparatus, adding a normal or anomalylabel to the feature vector based on the information on the warning orfailure time, and retrieving a combination of features based on the casein which a ratio of an anomaly measurement of the feature vector addedwith the anomaly label to an anomaly measurement of the feature vectoradded with the normal label is the maximum.
 5. The method for monitoringthe state of facility according to claim 3, wherein the feature isselected by inputting information on a warning or failure time of thefacility or apparatus, adding a normal or anomaly label to the featurevector based on the information on the warning or failure time, andretrieving a combination of features based on the case in which a ratioof an anomaly measurement of the feature vector added with the anomalylabel to an anomaly measurement of the feature vector added with thenormal label is the maximum.
 6. The method for monitoring the state offacility according to claim 2, wherein the learning data is selected bycreating a plurality of normal models by random sampling from data otherthan data of a target cycle for each one operating cycle with respect toall learning data, computing a plurality of anomaly measurements of thedata of the target cycle by using all the plurality of normal models,computing the predetermined number of means from the plurality ofanomaly measurements of each data, acquiring a maximum value of the meanduring the target cycle, and excluding data of a cycle in which themaximum value of the mean is larger than a predetermined threshold, fromthe learning data.
 7. The method for monitoring the state of facilityaccording to claim 3, wherein the learning data is selected by creatinga plurality of normal models by random sampling from data other thandata of a target cycle for each one operating cycle with respect to alllearning data, computing a plurality of anomaly measurements of the dataof the target cycle by using all the plurality of normal models,computing the predetermined number of means from the plurality ofanomaly measurements of each data, acquiring a maximum value of the meanduring the target cycle, and excluding data of a cycle in which themaximum value of the mean is larger than a predetermined threshold, fromthe learning data.
 8. A method for monitoring the state of facility thatdetects an anomaly based on a time-series sensor signal and an eventsignal output from the facility or an apparatus, comprising: a learningprocess of dividing a mode for each operating state based on the eventsignal, extracting a feature vector based on the sensor signal,selecting a feature to be used based on data check of the featurevector, selecting learning data to be used based on data check of thefeature vector, creating a normal model for each mode based on theselected learning data, checking sufficiency of the learning data usedfor creating the normal model for each mode, and setting a threshold inaccordance with the sufficiency of the learning data; and an anomalydetecting process of dividing the mode for each operating state based onthe event signal, extracting the feature vector based on the sensorsignal, computing an anomaly measurement by comparing the feature vectorwith the normal model, and identifying the anomaly by comparing thethreshold with the anomaly measurement.
 9. The method for monitoring thestate of facility according to claim 8, wherein the learning data isselected by acquiring information on a warning or failure, informationon start and stop sequences, and information on occurrence of an eventor event array having a low frequency, based on the event signal anddetermining exclusion by the predetermined basic unit based on theacquired information.
 10. A method for monitoring the state of facilitythat detects an anomaly based on a time-series sensor signal and anevent signal output from the facility or an apparatus, comprising: alearning process of dividing a mode for each operating state based onthe event signal, extracting a feature vector based on the sensorsignal, creating a normal model for each mode based on the featurevector, checking sufficiency of the learning data used for creating thenormal model for each mode, and setting a threshold in accordance withthe sufficiency of the learning data; and an anomaly detecting processof dividing the mode for each operating state based on the event signal,extracting the feature vector based on the sensor signal, computing ananomaly measurement by comparing the feature vector with the normalmodel, and identifying the anomaly by comparing the threshold with theanomaly measurement.
 11. The method for monitoring the state of facilityaccording to claim 10, wherein in the learning process, the featurevector at the time when the anomaly is judged by the anomalyidentification is quantized to be set as a cause event and a failureevent which occurs from the time of the anomaly judgment to the passageof a predetermined time is set as a result event, and a frequency matrixof a combination of the cause event and the result event is created, andin the anomaly detecting process, the occurrence of the result event ispredicted based on the frequency matrix created in the learning processand the feature vector at the time when the anomaly is judged by theanomaly identification.
 12. The method for monitoring the state offacility according to claim 11, wherein at the time of predicting theoccurrence of the result event, a normal sensor signal computed based onthe normal model and the feature vector and an actual sensor signal areoverlapped and displayed with respect to a predetermined time before orafter the anomaly judgment.
 13. The method for monitoring the state offacility according to claim 11, wherein at the time of predicting theoccurrence of the result event, a normal sensor signal computed based onthe normal model and the feature vector and an actual sensor signal areoverlapped and displayed with respect to learning data in which thepredicted result event and an input cause event coincide with eachother.
 14. A method for monitoring the state of facility, comprising:mode-dividing a time-series event signal output from the facility or anapparatus in accordance with an operating state of the facility orapparatus; acquiring a feature vector from a time-series sensor signaloutput from the facility or apparatus; creating a normal model for eachdivided mode by using the mode dividing information and information onthe feature vector acquired from the sensor signal; computing an anomalymeasurement of the feature vector for each divided mode by using thecreated normal model; judging an anomaly by comparing the computedanomaly measurement with a predetermined threshold; and diagnosingwhether the facility or apparatus is anomalistic by using the judgedanomaly information and the sensor signal.
 15. The method for monitoringthe state of facility according to claim 14, wherein in the normal modelcreating process, learning data is selected from the acquired featurevector for each divided mode, and the normal model is acquired by usingthe learning data selected for each mode.
 16. The method for monitoringthe state of facility according to claim 15, further comprising: aprocess of checking sufficiency of the learning data for each selecteddivided mode, wherein a threshold of an anomaly measurement for judgingthe anomaly is set for each divided mode in accordance with a result ofchecking the sufficiency of the learning data for each divided mode inthe process.
 17. The method for monitoring the state of facilityaccording to claim 15, wherein the computed anomaly measurement and theset threshold of the anomaly measurement are displayed on a screen. 18.A device for monitoring the state of facility, comprising: a modedividing means inputting a time-series event signal output from thefacility or an apparatus to mode-divide the event signal in accordancewith an operating state of the facility or apparatus; a feature-vectorcomputation means inputting the time-series sensor signal output fromthe facility or apparatus to acquire a feature vector from the inputsensor signal; a normal-model creation means creating a normal model foreach divided mode by using the mode dividing information from the modedividing means and information on the feature vector of the sensorsignal acquired by the feature-vector computation means; ananomaly-measurement computation means computing an anomaly measurementof the feature vector acquired by the feature-vector computation meansfor each divided mode by using the normal model created by thenormal-model creation means; an anomaly judgment means judging ananomaly by comparing the anomaly measurement computed by the anomalymeasurement computation means with a predetermined threshold; and ananomaly diagnosis means diagnosing whether the facility or apparatus isanomalistic by using the information on the anomaly judged by theanomaly judgment means and the time-series sensor signal output from thefacility or apparatus.
 19. The device for monitoring the state offacility according to claim 18, wherein the normal-model creation meansincludes: a learning-data selection unit selecting learning data foreach mode divided by the mode dividing means from the feature vectoracquired by the feature-vector computation means; and a normal-modelcreation unit acquiring the normal model by using the learning dataselected for each mode by using the learning-data selection unit. 20.The device for monitoring the state of facility according to claim 19,further comprising: a learning-data check means checking sufficiency ofthe learning data for each divided mode, which is selected by using thelearning-data selection unit of the normal-model creation means, whereina threshold of an anomaly measurement for judging the anomaly is set foreach divided mode in accordance with a result of checking thesufficiency of the learning data for each divided mode in thelearning-data check means.
 21. The device for monitoring the state offacility according to claim 20, further comprising: a display meansdisplaying the anomaly measurement computed by using the means forsetting the threshold and the set threshold of the anomaly measurementon the screen.